EUVD-2026-51127Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network login flow (AV:N/AC:L), requires an existing Editor account so PR:L not PR:N, no user interaction, and admin takeover yields full C/I/A impact within the same system (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.
AnalysisAI
Privilege escalation in the Serendipity (s9y) PHP blogging platform before 2.6.1 lets an authenticated Editor take over an Administrator account by exploiting an authentication context confusion (CWE-304): password checking and session loading resolve the user independently rather than binding to a single record. By registering a username that collides with an Administrator's, the Editor logs in with their own password yet has the Administrator's account loaded into their session, inheriting full admin rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege account (Editor role, PR:L) and the ability to create a username that collides with an existing Administrator account, which is the exact precondition named in the description ('create a username collision with an Administrator account'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, SC:N) describes a network-reachable, low-complexity attack requiring low privileges (an existing Editor account) and no user interaction, yielding full compromise of the vulnerable system - a coherent and internally consistent signal for a serious privilege-escalation bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds (or is granted) an Editor account on a shared Serendipity blog creates or renames an account so its username collides with an existing Administrator, then simply logs in through the normal web login form using their own password. Because the session is populated with the Administrator's record, the attacker gains full administrative control of the CMS. … |
| Remediation | Vendor-released patch: 2.6.1 - upgrade all Serendipity installations to 2.6.1 or later, which enforces that password validation and session loading resolve to the same user record and prevents privilege-inheriting username collisions; see the vendor advisory GHSA-v645-243f-jwgh (https://github.com/s9y/Serendipity/security/advisories/GHSA-v645-243f-jwgh) and the VulnCheck writeup (https://www.vulncheck.com/advisories/serendipity-authentication-bypass-via-username-collision). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Serendipity deployments to identify versions before 2.6.1 and audit all Editor-level user accounts currently active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Serendipity
View allAn arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted
SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to
Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1
Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.p
include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Exe
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Seren
Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed
Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inje
Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web scr
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a ne
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users
Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. Rated high severity (
Same weakness CWE-304 – Missing Critical Step in Authentication
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today